Request For Complaints #2
Inter9 Engineering Task Force
Path Key Infrastructure (PKI)
The path key infrastructure (PKI) relies on FNS. It is necessary to be familiar with FNS before reading this document.
PKI is designed to replace the centralized public key infrastructure, which uses certificate authorities which are difficult to replace and which end-users have no control over.
When a client connects to the Inter9, it must choose a local server to trust. It imports a single certificate authority from the local server.
For example, suppose the user jrmu joins the server freeirc. He imports FreeIRC as a certificate authority. The hierarchy of the server is /freeirc
FreeIRC then signs the certificate for the root authority /. The / root authority then signs certificates for each of the entries in its directories, such as /ircnow and /cloud9p.
A user from /freeirc can therefore verify the certificate from /cloud9p as a result of this chain of signatures:
local FreeIRC CA -> root CA -> cloud9p -> subdomain certificates
If the root CA becomes abusive, the local servers can revoke the signature on the root certificate and sign a new root CA, forking the path key infrastructure. Because clients trust the local server directly, this fork would be seamless. This gives more power for local certificate authorities to deter the root CA from an abuse of power.
More importantly, users are not required to blindly import a list of 200+ Certificate Authorities they don't actually know or trust. Instead, only one single CA is imported, from the local server.